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(57 ) Abstract:_A n apparatus is arranged 
for providing drive-off security in a 
motor vehicle environment through 
blocking one or more vehicle engine 
system subfunctions (18), such blocking 
is triggered by detecting an unauthorized 
system activation. In particular, a 
particular such sub-function facility 
comprises (14) an on-off control circuit 
(14) pertaining to and controlling a fuel 
pump arrangement functionality (18). 
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Description 

An apparatus for providing drive-off security in a motor vehi- 
cle environment and a motor vehicle being- provided with such 
5 apparatus 

The invention relates to an apparatus arranged for providing 
drive-off prevention security in a motor vehicle environment 
through blocking one or more vehicle engine system subfunc- 
10 tions, such blocking being triggered by a detection of an un- 
authorized system activation. 

Motor vehicle theft, joyriding and various other categories of 
unauthorized motor vehicle appropriation have become an ever 

15 increasing risk, especially in view of the growing sophistica- 
tion of the offenders. Key-and-lock arrangements for vehicle 
doors, ignition control key systems, and various other meas- 
ures have been developed, using both mechanical and electronic 
means, but most of such security arrangements have in fact 

20 been located at the physical perimeter of the vehicle, so that 
they could be circumvented by measures like brute force, or by 
short-circuiting or replacing a part that provided the inhibit 
function by another part that did not . 

25 The present inventor has recognized that the inhibit element 
should as it were be placed in the heart of the vehicle where 
physical access to such element should require an unfeasible 
amount of effort, and that the combination of the fuel pump 
and fuel tank of the motor vehicle would offer an advantageous 

30 basis for locating such inhibit element. 

In consequence, amongst other things, it is an object of the 
present invention to allow the drive-off prevention security 
be attained through an on-of f control circuit pertaining to 
35 and controlling a fuel pump arrangement functionality means of 
the vehicle. 
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Now therefore, according to one of its aspects the invention 
is characterized in that a particular said sub-f unction facil- 
ity comprises an on-off control circuit pertaining to and con- 
trolling a fuel pump arrangement functionality means. 

5 

The invention also relates to a motor vehicle being provided 
with an apparatus as claimed in Claim 1 . 

According to a particularly advantageous aspect, operativity 
10 activation of the fuel pump arrangement requires a pre- 
established code word from a drive-off security electronic 
circuit. Further advantageous aspects of the present invention 
have been recited in dependent Claims. 

15 Now, United States Patent US-A-5 , 019 , 812 to Gostahagberg, et 
al . , describes an electronic locking system especially suited 
for a motor vehicle, wherein selective presetting of a par- 
ticular lock to match with a particular key is effected. How- 
ever, the reference does not contemplate to inhibit the opera- 

20 tivity of the protected vehicle through blocking the operation 
of the fuel pump, but only considers the personalization be- 
tween key and lock. The effectivity of the reference as teach- 
ing a drive-off prevention security against forceful, shrewd 
or cognizant offenders would be minimal. 

25 

These and further aspects and advantages of the invention will 
be discussed more in detail hereinafter with reference to the 
disclosure of preferred embodiments, and in particular with 
reference to the appended Figures that show: 

30 

Figure 1, an overall sketch of a motor vehicle arranged ac- 
cording to the present invention; 

Figure 2, a more extensive diagram of the key parts of a pres- 
35 ently preferred inventive embodiment. 

Figure 3, a flow chart of the preferred embodiment's opera- 
tion. 



WO 03/093076 PCT/EP03/02886 



Figure 1 illustrates an overall sketch of a motor vehicle em- 
bodiment being arranged according to the present invention. 
The motor vehicle itself has been succinctly indicated only by 
5 broken line rectangle 20. The rotary engine 22 is drivable by 
start engine 24 through drive mechanism 26 that has been drawn 
in broken lines , signalling that the driving by the start en- 
gine is only temporary. The specific type of the engine, the 
number of cylinders, and the mode of operation are not re- 

10 strictive to the present invention, further than the liquid or 
gaseous character of the fuel. Standard gasoline, propane or 
other gas type propulsion, fuel injection, diesel , Wankel, and 
various other types of engines would be applicable. Spark gen- 
eration S.G. mechanism 28 provides for adequate ignition of 

15 the fuel-air mixture inside engine 22. Fuel injection mecha- 
nism F.I. 3 0 provides for supplying an adequate amount of fuel 
as regarding the various operational conditions of engine 22. 
Fuel pump 32 provides fuel to the injection mechanism 30. By 
way of example, valve 3 6 has been interposed between fuel tank 

20 38 and fuel pump 32. Fuel tank 38 contains fuel with free sur- 
face level 40, and lid 44. 

Tank electronics 34 are physically joined with fuel pump 32 to 
a subassembly. A currently preferred embodiment is that the 

25 tank electronics are near the flange of the pump, or even in- 
tegrated therewith to constitute a single part or sub- 
assembly. Given the small size of the electronics in question, 
the space necessary therefor would cause no appreciable prob- 
lem. In particular with reference to motor vehicles, the fuel 

3 0 tank and/or fuel pump facilities used in the present embodi- 
ment have been difficult to physically access in most models, 
in particular, because they have been away from the vehicle's 
physical perimeter. Power supply facility 4 6 provides adequate 
electric power to various ones of the subsystems 24, 28, 30, 

35 and 32/34, which may be pertain both to standard electric 

voltages and also to dynamic or cyclic activation signals of 
an appropriate temporal character as have been extensively in 
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use in the motor vehicle industry. Furthermore, the setup com- 
prises a Tank Lid Sensor signal T.L.S., and a Fuel Level Sen- 
sor signal F.L.S., which signals are applied in such manner 
that no drive-off is possible with either a loose or absent 
5 tank lid, or with an insufficient amount of fuel present. For 

aflCMhaine runnina on aas , liriLA4_.. _.suf.f iciencv measurement of 
@PJL ENTER LANGUAGE =PCL 
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indicate an appropriate pressure value, such as gasoline. Ar- 
rows A, B , C are in ADC 54 converted to respective digital 
values . 

5 CPU 6 0 is the central element of the arrangement, and may be a 
special purpose design, or rather/ a general purpose specifi- 
cally programmed microprocessor as has been widely used in the 
art of digital control. For brevity, the various subsystems 
thereof have not been presented, inasmuch as microprocessor 

10 specifics are not crucial to the present invention. CPU 60 

contains an EE PROM 8 6 for storing various operational charac- 
teristics in the shape of digitized curves, the number of past 
errors associated to the drive-off prevention, and sequencing 
information for use with engine and possibly other control 

15 functions. At top right, terminal #15 (82), provided with a 
fuse as shown, provides a trigger signal to wake up the ar- 
rangement of Figure 2 from standby. A second terminal 3 0 (84") , 
also provided with a fuse is arranged for other purposes, such 
as for receiving unregulated power supply from the vehicle ac- 

2 0 cumulator. 

Block 8 0 is arranged for providing regulated power supply on 
line 62 to CPU 60. In particular, the power supply is failure- 
proof against short circuits and self -maintaining . The self- 
25 maintaining is activated through line 64 from CPU 60 and will 
control closing of relay 81. Such power supplies by themselves 
are conventional. The closing of relay 81 provides powering on 
line 66 to various further subsystems. When powered, power 
driver 70 will provide operating power to fuel pump 72, which 

3 0 may be based on an electric motor, such as e.g. a brushless 

motor, or other convenient facility. Power driver 7 0 to this 
effect has been shown with three current leads 71 each pro- 
vided with a rectifying cell. Furthermore, power driver 70 is 
internally provided with short circuit detection not shown in 
35 detail. Bidirectional multiline arrow 69 communicates a value 
indicating either a rotary field frequency, or rather a pulse- 
width modulation quantity, as the case may be, and such being 
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compatible with the nature of fuel pump 72 . The communication 
proper may be subject to a dialog protocol. The target value 
of pump rotation speed is set by overall engine control such 
as provided by a driver person and/or cruise control . Line 68 
is used to signal actual rotary speed of fuel pump 72 back 
from power driver 70 to CPU 60, such as being possibly subject 
to inertial or other delay of fuel pump 72 viz a viz control 
settings received on line 69: 

Watchdog block 7 8 receives a watchdog signal from CPU 60 on 
line 73, as well as power supply from block 80 on line 66. In- 
ternally in watchdog block 78, a bridging relay for the power 
supply signal has been shown. Through resistor 74 and a branch 
provided with a rectifier cell from one of the lines 71, under 
appropriate conditions a failure signal 76 carrying error data 
will be outputted, such as for visual display or other sig- 
nalization to the vehicle driver. Finally, bidirectional 
multi-line arrow 58 communicates dialog and diagnosis signals 
with an operator or other control mechanism, and will further- 
more serve for adjusting parameters of the fuel pump system as 
will be discussed more in detail hereinafter. In particular, 
this communication may include a specific codeword that has 
been agreed with an external circuit, and reception of which 
codeword will then be indispensible in the drive-off preven- 
tion security to effectively allow actual drive-off. However, 
other solutions not expressly using a code word could be fea- 
sible as well. Overall functionality of CPU 60 will include 
the following aspects: 

• drive-off prevention security inclusive of associated 
logic 

• demand dependent fuel pump control 

• watchdog 

• fuel level measuring and assessment, such as for calculat- 
ing the total tank volume in a multiple chamber tank 

• OBD (On Board Diagnosis) on defects such as e.g. tank 
leakage 

• recognizing of tank lid being in place or not 
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• delayed electrical termination of a refueling operation 

• EE memory for storing characteristics of fuel tank, such 
as height versus volume 

• dialoguing, such as through operating a standard and by 
5 itself prior art CAN bus protocol that has proved to be 

convenient for motor vehicles 

• input /output data of system pressure, given by an appro- 
priate sensor mechanism not shown 

• requirement data for fuel pump performance 

10 • time to prime, as temporal parameters pertinent to dynamic 

fuel injection and/or spark timing 

• level values of fuel 

Figure 3 illustrates a flow chart of the preferred embodi- 
15 merit's operation. In block 100, the system goes to standby at 
appropriate initialization under claiming and assigning of the 
necessary hardware and software facilities. Thus, at the at- 
tempted starting of the motor vehicle, the tank electronics 
(TE) will be in standby mode and will be awakened (block 102) 
20 through the asserting of terminal 15. In case the tank lid is 
signaled (detected in block 104, N) "not closed", the engine 
will not start, but will signalize so in block 122 and effec- 
tively implement a waiting loop. The tank electronics will 
transmit a pertinent message through the dialog interface (DS) 
25 to the combinator or, respectively, information display. 

Otherwise (Y in block 104), the fuel pump (KP) will get run- 
ning immediately (activated in block 106) , while motor control 
will go to check the legitimity and will transmit the cur- 

3 0 rently valid code word to the Tank Electronics (activated in 

block 108) . The code is associated to the operator in a manner 
that by itself is state-of-the-art, such as through a re- 
programmable key, an external code to be introduced by hand, a 
combination thereof, or other. If no codeword or an erroneous 

35 code word arrives (signaled in block 110) , the fuel pump will 
be cut down after a preset timeout (or grace period) such as 
two seconds, and the counter value for code faults incremented 
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(this is effected in block 112) . The counter value may be op- 
tionally reset to zero at three consecutive, properly executed 
engine start operations. The attaining of a preset maximum 
value for the number of unauthorized start attempts will be 
5 detected in block 114 and/or the running-out of a grace pe- 
riod, will in block 116 set a permanent failure bit in the 
EEPROM. This bit value will subsequently immediately abort all 
further start attempts in block 12 0. The failure bit can only 
be reset when the tank electronics have been dismantled from 

10 the motor vehicle, followed by a new Initial Reset. This Ini- 
tial Reset will thereupon effect that the next received deac- 
tivating code will be received and processed. Subsequently, 
the tank electronics will set the subsequent deactivating 
codes. All unsuccessful attempts will be counted in the EE PROM 

15 for being taken into account . If the check of the code word is 
repeated through a retry in block 118, and gets positive be- 
fore the end of the above grace period, such as in a second or 
further attempt, the tank electronics will ignore any possible 
code fault and let the fuel pump go on. This procedure mini- 

20 mizes the starting time or time-to-prime in the normal situa- 
tion, while, allowing for a temporary or accidental transmis- 
sion of an erroneous code. 

This success (Y in block 110) will then trigger a self holding 
25 of terminal 15 through the voltage regulator, which selfhold- 
ing may only be terminated through disappearance of the signal 
on terminal 15 . This guarantees that in case of (temporary) 
hardware or software errors the power supply remains assured 
for the fuel pump, and that the intended operation of the ve- 
30 hide may continue in block 124. 

During standard operation after the start of the motor vehi- 
cle, the electronics will control the fuel pump through pulse 
width modulation in case of a DC motor. In case of an electri- 
3 5 cal brushless motor, the control is effected through the ro- 
tary field. This allows assessing of the pressure produced by 
the fuel pump with the pressure sensor. The target value 
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therefor may be specified through the dialog interface, and 
the actual value is used as a control value. The actual value 
may again be communicated through the interface. In case of 
control jumps, the CPU may signal an advance message, to mini- 
5 mize the dead time of the system. This additional control fa- 
cility will manage or improve hot starts, that generally will 
briefly need a raised pressure . 

Simultaneously, the CPU will continually output a pulse train 
10 to the watchdog. If these are interrupted through a software 
or hardware failure, the watchdog will switch the fuel pump 
permanently and self -holding onto terminal 15 for a DC motor 
only. Effectively, this represents an unregulated emergency, 
which separately sets an error bit, meaning a high-low signal 
15 change. 

The level signals received are accounted via a characteristic 
curve field, and will as an overall result be communicated 
through the dialog interface to the combination. In the ideal 

2 0 case, the fuel tank level provides a linear curve from 0% to 

10 0%. In the combination instrument only one parameter needs 
to be communicated, that is, how many liters correspond to 
100%. This decouples the indication system from the fuel tank 
characteristic . 

25 

The tank electronics will recognize the cutoff of the engine 
through the switching down of terminal 15 as indicated by the 
Y output of block 126. Otherwise, this block 126 effectively 
operates as a waiting loop (output N) . This cutoff will switch 

3 0 off the fuel pump (not shown in the diagram) . Next, the CPU 

will in block 12 8 generate a new dynamic code word for the 
drive -off prevention. This is communicated to the MSE in block 
130, which may be located in the driver person's key, or be 
memorized in another manner, and acknowledged electronically. 
3 5 Thereupon, the system may proceed to standby, as corresponding 
to block 102, supra. If, on the other hand, the system was 
running in emergency mode, then upon engine cutoff the self- 
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holding relay 81 will open, inasmuch as it was held closed 
through terminal 15, the latter in fact holding the relay 
closed. Thereafter, the tank electronics will go back to 
standby (for being eventually awakened again in block 102) . 
5 Because of the emergency drive facility of the fuel pump, the 
fuel system must be provided wi,th a mechanical pressure regu- 
lator, which has a pressure above the controlled pressure. 

Generally, the flow chart of Figure 3 has left out several as- 
10 pects of the invention that were discussed supra, such as the 
re-initializing procedure, the running in the emergency state, 
and the measuring of the system pressure. All of these would 
be clear to the skilled art practitioner however, in view of 
the other discussions presented supra. 

15 

Now, the present invention has here above been fully disclosed 
with reference to preferred embodiments. However, persons 
skilled in the art will readily recognize various changes and 
amendments thereto. In view of this, unless such changes or 
2 0 amendments will fall outside the scope of the accompanying 

Claims, they shall be construed as forming fully part of the 
present invention. 
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Claims : 

1. An apparatus arranged for providing drive -off security 
in a motor vehicle (2 0) environment through blocking one 
or more vehicle engine system subf unctions , such block- 
ing being triggered by a detection of an unauthorized 
system activation, said apparatus being characterized in 
that a particular said sub-function facility (34) com- 
prises an on-off control circuit pertaining to and con- 
trolling a fuel pump (32) arrangement functionality 
means . 

2. An apparatus as claimed in Claim 1, being character- 
ized in that said control circuit is physically arranged 
in the immediate vicinity of a fuel tank (3 8) of the mo- 
tor vehicle . 

3. An apparatus as claimed in Claim 1, being character- 
ized in that said control circuit is physically inte- 
grated with a fuel tank (38) or fuel pump (32) element 
of said motor vehicle. 

4. An apparatus as claimed in Claim 1, being character- 
ized in that in operativity activation, said fuel pump 
arrangement requires a pre-established code word from a 
drive-off security electronic circuit. 

5. An apparatus as claimed in Claim 1, being character- 
ized in that said drive-off security circuit further en- 
compasses one or more further items (Bl, B2 , B3) from 
start means (24) inhibition, spark means (2 8) inhibi- 
tion, and fuel injection means (30) inhibition facili- 
ties . 

6. A motor vehicle being provided with an apparatus as 
claimed in Claim 1 for providing drive-off security of 
said motor vehicle (2 0) through blocking one or more ve- 
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hicle engine system subf unctions, such blocking being 
triggered by a detection of an unauthorized system acti- 
vation, being characterized in that a particular said 
sub-function facility (34) comprises an on-off control 
circuit pertaining to and controlling a fuel pump (3 2) 
arrangement functionality means. 
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